001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.junit.jupiter.api.Assertions.assertEquals;
021import static org.junit.jupiter.api.Assertions.assertNull;
022
023import org.apache.hadoop.conf.Configuration;
024import org.apache.hadoop.hbase.testclassification.MiscTests;
025import org.apache.hadoop.hbase.testclassification.SmallTests;
026import org.junit.jupiter.api.Tag;
027import org.junit.jupiter.api.Test;
028
029/**
030 * Unit tests for {@link InfoServer}'s TLS-config resolution: the 3-tier fallback chain
031 * ({@code hbase.ui.ssl.server.*} → {@code hbase.ui.ssl.*} → {@code ssl.server.*}) that underpins
032 * single-EKU certificate support on the UI surface.
033 */
034@Tag(MiscTests.TAG)
035@Tag(SmallTests.TAG)
036public class TestInfoServerTLSConfig {
037
038  private static final String POSTFIX = "keystore.location";
039  private static final String ROLE_SCOPED_KEY = "hbase.ui.ssl.server." + POSTFIX;
040  private static final String HBASE_KEY = "hbase.ui.ssl." + POSTFIX;
041  private static final String HADOOP_KEY = "ssl.server." + POSTFIX;
042
043  @Test
044  public void testRoleScopedTakesPrecedenceOverHBasePrefixed() {
045    Configuration c = new Configuration(false);
046    c.set(ROLE_SCOPED_KEY, "role-scoped-value");
047    c.set(HBASE_KEY, "hbase-prefixed-value");
048    c.set(HADOOP_KEY, "hadoop-prefixed-value");
049    assertEquals("role-scoped-value", InfoServer.getTLSProperty(c, POSTFIX));
050  }
051
052  @Test
053  public void testHBasePrefixedTakesPrecedenceOverHadoopPrefixed() {
054    Configuration c = new Configuration(false);
055    // No role-scoped key set — hbase-prefixed key must win.
056    c.set(HBASE_KEY, "hbase-prefixed-value");
057    c.set(HADOOP_KEY, "hadoop-prefixed-value");
058    assertEquals("hbase-prefixed-value", InfoServer.getTLSProperty(c, POSTFIX));
059  }
060
061  @Test
062  public void testFallsBackToHadoopPrefixedWhenNoOthersSet() {
063    Configuration c = new Configuration(false);
064    c.set(HADOOP_KEY, "hadoop-prefixed-value");
065    assertEquals("hadoop-prefixed-value", InfoServer.getTLSProperty(c, POSTFIX));
066  }
067
068  @Test
069  public void testReturnsDefaultWhenNoneSet() {
070    Configuration c = new Configuration(false);
071    assertEquals("jks", InfoServer.getTLSProperty(c, POSTFIX, "jks"));
072    assertNull(InfoServer.getTLSProperty(c, POSTFIX));
073  }
074
075  @Test
076  public void testGetTLSPasswordHonorsThreeTierFallback() throws Exception {
077    Configuration c = new Configuration(false);
078    // Configuration.getPassword returns null when unset; verifying the fallback picks each tier.
079    c.set(ROLE_SCOPED_KEY.replace("keystore.location", "keystore.password"), "role-pw");
080    c.set(HBASE_KEY.replace("keystore.location", "keystore.password"), "hbase-pw");
081    c.set(HADOOP_KEY.replace("keystore.location", "keystore.password"), "hadoop-pw");
082    assertEquals("role-pw", InfoServer.getTLSPassword(c, "keystore.password"));
083
084    c.unset(ROLE_SCOPED_KEY.replace("keystore.location", "keystore.password"));
085    assertEquals("hbase-pw", InfoServer.getTLSPassword(c, "keystore.password"));
086
087    c.unset(HBASE_KEY.replace("keystore.location", "keystore.password"));
088    assertEquals("hadoop-pw", InfoServer.getTLSPassword(c, "keystore.password"));
089
090    c.unset(HADOOP_KEY.replace("keystore.location", "keystore.password"));
091    assertNull(InfoServer.getTLSPassword(c, "keystore.password"));
092  }
093}